CVE-2020-11819
In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.
Date published : 2020-04-16
https://fatihhcelik.blogspot.com/2020/01/rukovoditel-rce-via.html